Snort mailing list archives
Re: Stopping outbound Kazaa
From: Gustavo Beltrami Rossi <rossi () rec homeip net>
Date: Mon, 10 Feb 2003 11:52:53 -0200
| On Thu, Feb 06, 2003 at 12:40:35PM -0500, Travis S. wrote: | > On a large 1 gbps full-duplex internet pipe, I want to prevent | outside users from downloading files on Kazaa, gnutella, etc from our | network. On the other hand, I don't want to stop our users from | downloading these files from the outside. | > | > Basically the idea is to manage the uncontrolled outbound stream so | we have spare - right now it's pegged 100% usage. | > | > Has anybody figured out clever ways to accomplish this using snort | or any other package? Obviously I would prefer a free solution, so | it would be great if Snort could do this. I'm working on a project to limit the bandwidth of p2p applications using snort sigs and altq (OpenBSD). The idea is to monitor the snorts alerts of p2p traffic sigs and then generate on the fly filters of altq. I'm now finishing the development of that interconection software (snort->altq), and then I'll start collecting sigs of p2p softwares. In that fase, anybody knows if is it possible to catch a sig across multiples packets on the same stream? If it is, please let me know how. Something like that: host1 -> host2 : GET /GET/ (pkt 1) host2 -> host1 : SERVER OK (pkt 2) I'm using snort 1.9 with stream4 enabled. Thanks in advance, Rossi. ------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Stopping outbound Kazaa Travis S. (Feb 06)
- Re: Stopping outbound Kazaa twig les (Feb 06)
- Re: Stopping outbound Kazaa Brian (Feb 07)
- Re: Stopping outbound Kazaa Gustavo Beltrami Rossi (Feb 10)
- <Possible follow-ups>
- Re: Stopping outbound Kazaa Travis S. (Feb 06)
- Re: Stopping outbound Kazaa Travis S. (Feb 13)
- Re: Stopping outbound Kazaa Erek Adams (Feb 13)
- Re: Stopping outbound Kazaa twig les (Feb 13)
- Re: Stopping outbound Kazaa Gustavo Beltrami Rossi (Feb 14)
- Re: Stopping outbound Kazaa Erek Adams (Feb 13)
- RE: Stopping outbound Kazaa Bob McDowell (Feb 14)